Controlling what can reach your server

Server → Security → Firewall decides what can reach the server from the internet. Everything not listed on the page is closed. Your changes are drafts until you apply them, and every apply undoes itself after 90 seconds unless you keep it, so a mistake can't lock you out for long.

If you're already locked out, see Getting back in after a firewall lockout.

Turning the firewall on

1. Open Server → Security → Firewall and check the list under Open for this server's services.
2. Add any other ports you need under Open ports (see below).
3. Press Turn on.
4. Check that you can still open the panel and reach SSH, then press Keep these rules before the countdown ends.

Turning the firewall on, applying changes and turning it off need a recent sign-in. If you signed in more than 10 minutes ago, the panel asks you to sign in again first.

The firewall won't start while ufw is active on the server. Turn ufw off first.

What's always open

• SSH: the ports your SSH server actually listens on, read from its configuration each time you apply. You can't close them from this page.
• Websites: ports 80 and 443.
• The server itself, Docker and Tailscale: traffic from the server to itself, from Docker's networks and over Tailscale is always let in.
• Ping and the other network messages a server needs to work properly.

Ports Hostctl opens for your services

Open for this server's services lists the ports Hostctl opens because a service is running:

• FTP: port 21 and the passive ports 30000–31000, when the FTP server is running.
• Mail: whichever of 25, 465, 587, 993 and 995 the mail server listens on.
• Portainer agent: port 9001, when the agent is reachable from outside the server.
• Tailscale direct connections: UDP port 41641, when Tailscale is running.

When a service starts or stops later, the page says You have changes that aren't applied yet. Press Apply changes to bring the open ports up to date.

Opening a port

Under Open ports, choose the Protocol (TCP, UDP or Both), enter the Port, and press Add. For a range, put the last port in To (optional). To open it to one address or network only, enter it in From (optional), such as 203.0.113.7 or 203.0.113.0/24.

Then press Apply changes and keep the rules. To close a port again, press the × next to it and apply.

Blocking an address

Under Blocked addresses, enter an Address or range, add a Note (optional) to remind you why, and press Block. Then apply.

A blocked address can't reach anything on the server, SSH included. Check you're not blocking your own network.

Lifting or keeping a fail2ban ban

fail2ban bans an address after repeated failed sign-ins. Its current bans appear under Blocked addresses, tagged with the jail that banned them and when the ban lifts. They take effect straight away and don't need applying.

• Unban lifts the ban now. Use it when a customer locked themselves out.
• Block permanently copies the address to your block list, so it stays blocked after the ban lifts. Like any change, apply it to take effect.

Hostctl's own jails ban for an hour:

Shown as	Bans after
WordPress logins	10 failed WordPress sign-ins in 10 minutes, on any site. The ban covers every website and the panel.
postfix-sasl	5 failed sign-ins to send mail in 10 minutes.
hostctl-dovecot	5 failed mailbox sign-ins (IMAP or POP3) in 10 minutes.

You may also see fail2ban's own jails, such as sshd for SSH.

Docker-published ports

Containers can publish ports themselves, which would normally slip past a firewall. Here, with the firewall on, a published port is closed to the internet until you allow it. Docker-published ports lists each one with the containers that publish it:

• Closed: press Allow to add it to your open ports, then apply.
• Open to the internet: one of your open-port rules covers it.
• Local only: the container only listens on the server itself.

A port that a domain proxies to says Proxied by and the domain's name. That domain keeps working with the port closed, so only allow it if people need to reach the container directly.

Limiting who can open the panel

Under Panel access, you can let only listed addresses open the panel. Websites aren't affected.

1. Press Add mine to add the address you're on now (shown as Your address), and Add any others, such as your office network.
2. Turn the Panel access switch on.
3. Apply and keep the rules.

Applying refuses if your current address isn't on the list, or if the list is empty. Everyone else gets "403 Forbidden" from the panel. Git deployment webhooks are always let through, so GitHub and GitLab can still start deploys.

If the panel is behind Cloudflare's proxy, the page says so, and the allowlist checks the visitor's real address rather than Cloudflare's. If the panel isn't served through the server's own web server, the allowlist isn't available.

If your internet provider gives you a new address, you'll be shut out of the panel. Add a second address you can use, or keep SSH access handy. The fix is in Your address isn't on the panel allowlist.

The 90-second safety window

After you press Turn on or Apply changes, the page asks Keep these rules? and counts down from 90 seconds. Use that time to check you can still reach the panel and SSH, then press Keep these rules. Kept rules also load when the server restarts.

If you don't keep them in time, the previous rules and panel allowlist come back by themselves. That's what saves you when a change cuts you off: wait for the countdown, reload the page, and you're back on the old rules.

Turn off removes all the firewall's rules and the panel allowlist at once, so every listening port becomes reachable. fail2ban bans still apply. The Panel access switch turns off too; its list of addresses is kept for when you turn it on again.

Seeing which country an address is from

Install IP Country Data on Server → System → Features and the Firewall page shows a country next to single addresses: blocked addresses, fail2ban bans and panel allowlist entries. It uses DB-IP's free country database, looked up on the server itself and refreshed each month. Nothing is sent anywhere.